According to authorities, John Daghita allegedly stole $46 million in cryptocurrency from the U.S. Marshals Service, with the theft reportedly dating back to late 2024. The arrest occurred the night from Wednesday to Thursday, March 4, 2026, on Saint Martin, with FBI director Kash Patel announcing it on Thursday. Authorities said the arrest involved a joint operation by the FBI and French GIGN forces. During the arrest, authorities seized a silver briefcase filled with hundred-dollar bills, hard drives, USB keys, and digital asset wallets. John Daghita's extradition to the U.S. is expected, though the legal basis and process for this extradition remain unclear.
John Daghita worked for Command Services & Support, a Virginia-based contractor owned by his father. Authorities allege that Command Services & Support managed seized digital assets for the Marshals Service, allowing John Daghita access to private cryptocurrency accounts. Authorities have not elaborated on how exactly the theft occurred, leaving the method unspecified. The role and potential involvement of Command Services & Support or other parties in the alleged theft are also under investigation, with no further details provided.
The investigation was launched in January after tips from an X user, ZachXBT. ZachXBT claimed John Daghita funneled tens of millions from crypto wallets linked to government seizures and identified him through his nickname 'Lick'. ZachXBT reported accounts held 12,540 ETH, worth roughly $36.3 million. In contrast to the $46 million figure cited by authorities, ZachXBT claimed $90 million or more in suspected thefts. This discrepancy highlights the broader scope of ZachXBT's analysis, which includes total suspicious funds controlled by wallets associated with Daghita, whereas the $46 million refers specifically to the amount allegedly stolen from the U.S. Marshals Service. The full extent and current status of the stolen cryptocurrency, including any recovery efforts, are not yet known.
Context from the story timeline reveals that the theft began in late 2024, with the investigation initiated in January 2026 after ZachXBT's public allegations. The arrest followed in March 2026, marking a rapid response by law enforcement. The Federal Bureau of Investigation (FBI) and its director Kash Patel played key roles, with Patel personally announcing the arrest. The French GIGN, an elite tactical unit, collaborated in the operation, underscoring the international nature of the case. The U.S. Marshals Service, as the victim agency, oversees seized assets, and Command Services & Support, as a contractor, was involved in managing these assets. John Daghita's connection to his father's company facilitated the alleged access, though specific mechanisms are not detailed.
Elaborating on the contradictions, the amount stolen presents two perspectives. Position A, supported by authorities, states that John Daghita allegedly stole $46 million in cryptocurrency from the U.S. Marshals Service. Position B, from ZachXBT, claims $90 million or more in suspected thefts. Research findings clarify that the $46 million figure pertains to direct theft from government wallets, while the $90 million+ estimate encompasses total suspicious funds in Daghita's associated wallets, including the stolen government assets. This distinction resolves the apparent conflict, indicating that ZachXBT's broader analysis identified additional suspicious activity beyond the Marshals Service theft. The investigation's origin with ZachXBT, who used blockchain analysis to trace funds, adds depth to understanding how the case unfolded, from initial tips to the arrest.
Further details include that the arrest involved a joint operation by the FBI and French GIGN forces, as confirmed by FBI director Kash Patel and French authorities. The seized items during the arrest, such as the briefcase with cash and digital storage devices, suggest evidence collection for the ongoing investigation. John Daghita's status as a government contractor through his father's company, Command Services & Support, raises questions about internal controls and oversight in managing seized assets. The case highlights vulnerabilities in cryptocurrency management by government agencies and contractors, with implications for future security measures. As the investigation continues, authorities are likely to pursue charges related to theft and unauthorized access, with extradition proceedings expected to follow. The involvement of multiple agencies and international cooperation demonstrates the complexity of cybercrime investigations in the digital age.